---
sourceDocument: Zurich Platform security
sourceDocumentLink: https://www.servicenow.com/docs/r/zurich/platform-security

 Release :

    - zurich

ft:locale :

    - en-US

ft:publication_title :

    - Zurich Platform security

ft:clusterId :

    - psec

bundleId :

    - psec

workflow :

    - Platform


---

# Set safe content security policy for svg files \[New in Security Center 1.3\]

# Set safe content security policy for svg files \[New in Security Center 1.3\] {#ariaid-title1}

* Release version: Zurich
* 
* Updated July 31, 2025
* 
* ![](https://www.servicenow.com/docs/portal-asset/ico-clock) 1 minute to read

The com.glide.csp.self_script_src_svg property adds the script-src none directive to the HTTP Content-Security-Policy header when Scalable Vector Graphics (SVGs) are accessed through
the Translation Memory Index (IIX) file extension.
The com.glide.csp.self_script_src_svg property prevents malicious file attachments that stores cross site scripting (XSS) attacks from running in an instance. Without this policy, a bad actor could cause a user
to run arbitrary JavaScript code in their web browser which could lead to security vulnerabilities such as data exfiltration and session takeover.

## More information {#sc-set-safe-content-security-policy-for-svg-files__section_qhx_1b1_xwb}

{#sc-set-safe-content-security-policy-for-svg-files__table_ajc_b43_3kb__entry__2}

| Attribute | Description |
|-|-|
| Configuration name | com.glide.csp.self_script_src_svg |
| Configuration type | System Properties (/sys_properties_list.do) |
| Data type | Boolean |
| Recommended value | true |
| Default value | true |
| Category | [Validation, sanitization, and encoding](https://www.servicenow.com/docs/EGuLOJWeGM7NY~gTADvUOw "Validation, sanitization, and encoding addresses input validation to prevent against vulnerabilities like Cross-Site Scripting (XSS), SQL injection and other attacks.") |
| Security risk | * Severity score: 7.1 * CVSS score: High * Security risk details: Not setting this property to the recommended value of true could cause a user to run arbitrary JavaScript code from a bad actor. {#sc-set-safe-content-security-policy-for-svg-files__ul_g1g_3sf_xwb} |
| Dependencies and prerequisites | None |
| Functional impact | This property prevents scalable vector graphics (SVG) files from accessing external scripts. |
[ ]

{#sc-set-safe-content-security-policy-for-svg-files__table_ajc_b43_3kb}